[log] Add debug logging to isRateLimitToolResult control flow

[github-actions]

Summary

Adds debug logging to internal/server/rate_limit.go's isRateLimitToolResult function to improve troubleshooting visibility into rate-limit detection.

Changes

• Reuses the existing logCircuitBreaker logger (server:circuit_breaker namespace) already used elsewhere in this file.
• Logs the early-return branch when the result is not a map.
• Logs the early-return branch when the result is not an error result (skipping rate-limit check).
• Logs when an error result's text does not match any known rate-limit patterns.

All log arguments are simple values with no side effects.

Validation

• go build ./... — succeeds
• go vet ./internal/server/ — clean
• go test ./internal/server/ — all tests pass (6.488s)

Exactly one file was modified (internal/server/rate_limit.go); no test files were touched.

Generated by Go Logger Enhancement · auto · 81.6 AIC · ⊞ 12.5K · ◷

[Copilot]

Pull request overview

Adds targeted debug logging for rate-limit detection control flow.

Changes:

• Logs all non-rate-limit early-return paths.
• Reuses the existing circuit-breaker logger.

Show a summary per file

File	Description
internal/server/rate_limit.go	Adds debug messages without changing detection behavior.

Review details

Tip

Add a code-review agent skill or configure MCP servers for context-aware, tailored reviews. Learn more in the docs.

• Files reviewed: 1/1 changed files
• Comments generated: 0
• Review effort level: Balanced

[github-actions]

🔒 mcpg Read-Only Stress — default AWF

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: default AWF (normal container isolation)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_prs/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused: Error [-32602]: unknown tool	BLOCKED	✅
C	CLI	reads (list_issues/list_commits/get_file_contents)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	refused: gh: GH_TOKEN not set	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	refused: gh: GH_TOKEN not set	BLOCKED	✅

Part B detail: Gateway exposes only 22 read-only tools. All 7 write tool attempts returned Error [-32602]: unknown tool — gateway enforces read-only by omitting write tools entirely.

Part D/E detail: gh CLI is unauthenticated (no GH_TOKEN), so all REST and GraphQL write attempts were blocked at the CLI layer.

Overall: PASS ✅

Run §31342177202

🔒 mcpg read-only stress (default AWF runtime) by Read-Only Stress: default runtime

[github-actions]

🔒 mcpg Read-Only Stress — gVisor

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: gVisor (runsc) kernel-level isolation

Part	Surface	Op	Result	Expected	Status
A	MCP	reads (list_issues/list_pull_requests/get_file_contents/list_commits)	data returned	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	Error [-32602]: unknown tool — gateway allowlist	BLOCKED	✅
C	CLI	reads (list_issues/get_file_contents via github proxy)	data returned	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	gh unauthenticated (no GH_TOKEN)	BLOCKED	✅

Overall: PASS

Part B enforcement: Gateway exposes only 22 read-only tools; write tool calls return Error [-32602]: unknown tool — a JSON-RPC gateway-level error (allowlist enforcement, not backend config).
Parts D/E: gh is unauthenticated in this job (no GH_TOKEN); all REST/GraphQL writes were rejected before reaching GitHub API.

References: §31342177178

🔒 mcpg read-only stress (gVisor runtime) by Read-Only Stress: gVisor runtime

[github-actions]

🔒 mcpg Read-Only Stress — docker-sbx

Surface coverage: MCP tool calls + proxied CLI (REST) + GraphQL mutations
Isolation runtime: docker-sbx (KVM-isolated microVM)

Part	Surface	Op	Result	Expected	Status
A	MCP	reads	data returned (issues/PRs/file/commits)	ALLOWED	✅
B	MCP	writes (reaction/star/issue/comment/branch/file/PR)	all refused — Error [-32602]: unknown tool (gateway read-only toolset)	BLOCKED	✅
C	CLI	reads	data returned (list_issues, get_file_contents)	ALLOWED	✅
D	CLI	REST writes (reaction/star/issue/comment/file)	all refused — HTTP 401 Bad credentials (gh unauthenticated)	BLOCKED	✅
E	CLI	GraphQL mutations (addReaction/addStar/createIssue)	all refused — HTTP 401 Bad credentials	BLOCKED	✅

Overall: PASS

Part B: mcpg exposes only 22 read-only tools; write tools return Error [-32602]: unknown tool — gateway enforces the read-only toolset at the proxy layer. Part D/E: gh is unauthenticated in this sandbox; GitHub API returns HTTP 401 for all write attempts.

🔒 mcpg read-only stress (docker-sbx runtime) by Read-Only Stress: docker-sbx runtime